FortiGuard Labs Finds Monero Miner, Gh0st RAT in Microsoft SQL Server Attacks

Cointime reports: FortiGuard Labs reported on Nov. 12 an attack campaign that compromises internet-exposed Microsoft SQL Server instances to install a Monero miner and a Gh0st RAT remote-access trojan. The attackers used a list of more than 2,700 passwords with usernames such as “sa” and “admin,” then enabled xp_cmdshell to pull payloads from their server. The miner masquerades as MicrosoftEdgeUpdate.exe and uses XMRig to mine Monero; the RAT persists via scheduled tasks running every 30 minutes.